CN115455440A - Transparent encryption method and device, electronic equipment and storage medium - Google Patents

Abstract

The invention relates to the technical field of encryption, in particular to a transparent encryption method, a device, electronic equipment and a storage medium, wherein the method comprises the steps of obtaining an operation request of a target file, wherein the operation request carries attribute information of the target file; determining the type of the operation request based on the attribute information, wherein the type of the operation request comprises an authorized operation request or an unauthorized operation request; redirecting the operation request to a virtual disk file system or a real file system according to the type of the operation request, wherein the virtual disk file system is used for interacting with the real file system, the virtual disk file is used for caching the decrypted target file, and the real file system is used for storing the encrypted target file. The virtual disk file system realizes the isolation of two forms of the same target file, and the isolation is carried out based on the type of the operation request during redirection, thereby realizing the transparent encryption of double-file control and having the high performance and stability of a layered file system.

Description

Transparent encryption method, device, electronic equipment and storage medium

technical field

The invention relates to the technical field of encryption, in particular to a transparent encryption method, device, electronic equipment and storage medium.

Background technique

Transparent encryption refers to the protection of files on the user's computer without changing the user's operating habits. The file is encrypted when it is written to the disk; when it is read, the authorized process is decrypted according to the judgment of the process, while other non-authorized processes are not decrypted. This can not only support users' daily editing and use of files, but also prevent users from leaking encrypted files and ensure data security.

Contents of the invention

In view of this, embodiments of the present invention provide a transparent encryption method, device, electronic equipment, and storage medium to solve the problem of transparent encryption.

According to the first aspect, an embodiment of the present invention provides a transparent encryption method, including:

Obtaining an operation request of the target file, the operation request carrying attribute information of the target file;

determining the type of the operation request based on the attribute information, where the type of the operation request includes an authorized operation request or an unauthorized operation request;

According to the type of the operation request, redirect the operation request to the virtual disk file system or the real file system, the virtual disk file system is used to interact with the real file system, and the virtual disk file is used to cache the decrypted The target file, the real file system is used to store the encrypted target file.

The transparent encryption method provided by the embodiment of the present invention realizes the isolation of two forms of the same target file through the virtual disk file system, that is, the encrypted target file is stored in the real file system, and the decrypted target file is cached in the virtual disk In the file system, the specific redirection is based on the type of operation request, thus realizing the transparent encryption of double file control, with the high performance and stability of the layered file system.

In some implementation manners, the redirecting the operation request to a virtual disk file system or a real file system according to the type of the operation request includes:

When the type of the operation request is an authorized operation request, redirecting the operation request to the virtual disk file system;

The operation request is processed in plain text based on the virtual disk file system.

The transparent encryption method provided by the embodiment of the present invention redirects the operation request to the virtual disk file system only when it is determined that the type of the operation request is an authorized operation request, so as to ensure the reliability of plaintext data.

In some implementations, the virtual disk file system includes a virtual disk and an encrypted file system, the virtual disk is used to mount the encrypted file system, and the encrypted file system is used to read encrypted files from the real file system After the target file is decrypted.

In the transparent encryption method provided by the embodiment of the present invention, the shadow file maintained by the encrypted file system and the file maintained by the real file system actually correspond to the same physical disk file, the shadow file accesses plaintext, and the real file system accesses ciphertext, with high performance and high stability sex. The redirection mechanism is used to forward the operation request to the virtual disk, which is compatible with anti-virus software and prevents the blue screen caused by the operation request of the transparent transmission shadow file to the real file system.

In some implementation manners, the plaintext operation of the target file based on the virtual disk file system includes:

Read the shadow file in the virtual disk to obtain the encrypted access path of the target file in the real file system;

reading the encrypted target file from the real file system based on the access path;

The encrypted file system is used to decrypt the encrypted target file, and the shadow file is used to cache the decryption result, so as to perform plaintext operations on the target file.

In the transparent encryption method provided by the embodiment of the present invention, the access path of the encrypted target file in the real file system is stored in the shadow file, and only when an operation request is received, the access path is used to read the encrypted target file With decryption, unnecessary memory overhead can be reduced by limiting the timing of reading.

In some implementation manners, the reading the shadow file in the virtual disk to obtain the encrypted access path of the target file in the real file system includes:

When obtaining the authorization opening request of the target file, creating a shadow file in the virtual disk;

An access path of the encrypted target file in the real file system is recorded in the shadow file.

In some embodiments, the method also includes:

When the authorization closing request of the target file is obtained, the shadow file is cleared in the virtual disk.

In the transparent encryption method provided by the embodiment of the present invention, shadow files are created and cleared according to requirements, which can release memory space in time and reduce memory consumption.

In some embodiments, the method also includes:

When the operation request is an unauthorized operation request, redirecting the operation request to the real file system;

A ciphertext operation is performed on the target file based on the real file system.

In the transparent encryption method provided by the embodiment of the present invention, for an unauthorized operation request, the operation request is directly redirected to the real file system for ciphertext operation, which improves the security of the target file.

According to the second aspect, an embodiment of the present invention also provides a transparent encryption device, including:

An acquisition module, configured to acquire an operation request of a target file, wherein the operation request carries attribute information of the target file;

A determining module, configured to determine the type of the operation request based on the attribute information, where the type of the operation request includes an authorized operation request or an unauthorized operation request;

A redirection module, configured to redirect the operation request to a virtual disk file system or a real file system according to the type of the operation request, the virtual disk file system is used to interact with the real file system, and the virtual disk The file is used to cache the decrypted target file, and the real file system is used to store the encrypted target file.

According to a third aspect, an embodiment of the present invention provides an electronic device, including: a memory and a processor, the memory and the processor are connected to each other in communication, the memory stores computer instructions, and the processor By executing the computer instructions, the transparent encryption method described in the first aspect or any implementation manner of the first aspect is executed.

According to a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute any of the first aspect or the first aspect. A transparent encryption method described in an implementation manner.

Description of drawings

In order to more clearly illustrate the specific implementation of the present invention or the technical solutions in the prior art, the following will briefly introduce the accompanying drawings that need to be used in the specific implementation or description of the prior art. Obviously, the accompanying drawings in the following description The drawings show some implementations of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative work.

Figure 1 shows a schematic diagram of transparent encryption based on a layered file system;

Fig. 2 is a flowchart of a transparent encryption method according to an embodiment of the present invention;

Fig. 3 is a flowchart of a transparent encryption method according to an embodiment of the present invention;

Fig. 4 is a schematic diagram of a transparent encryption method according to an embodiment of the present invention;

5 is a schematic diagram of a transparent encryption method according to an embodiment of the present invention;

Fig. 6 is a structural block diagram of a transparent encryption device according to an embodiment of the present invention;

FIG. 7 is a schematic diagram of a hardware structure of an electronic device provided by an embodiment of the present invention.

detailed description

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts belong to the protection scope of the present invention.

Generally, transparent encryption is implemented based on the windows kernel layer. By filtering requests for opening and closing, reading and writing files, etc. at the kernel layer, it is determined whether to encrypt and decrypt according to the permissions and file types of different processes. However, due to the caching mechanism of the Windows operating system, when the caching mechanism is enabled, different processes reading and writing the same file are actually reading and writing the same file cache. The authorized process needs to access the plaintext, while the non-authorized process needs to access the ciphertext, which leads to the need for cache switching when the two types of processes alternately operate the same encrypted file. However, such methods not only reduce performance, but frequent cache clearing may also damage files.

Furthermore, a double-caching solution based on a layered file system (ie, layerfsd) exists to solve performance problems. The so-called hierarchical file system is to expand the traditional encrypted filter driver into a half-filter driver and half-file system. The encrypted driver not only filters file read and write requests, but also interacts with windows io manager, cache manager, and kernel manager. A disk file is created and maintained with two file control blocks (FCB for short), and two caches are established. In this way, the authorized process and the unauthorized process are equivalent to accessing two files without interfering with each other, which solves the performance problem and improves the stability. However, layerfsd is not a real file system, but a filter driver at the same level as antivirus software. In order to prevent some malicious software from threatening user data by filtering file operations, the antivirus software can directly obtain the file system drive device of the current disk after intercepting user read and write requests at the upper layer, and transparently transmit user data to the underlying file system. This bypasses all intermediate filter driver layers, including layered filesystem drivers. Not only will this cause errors in the encrypted file data, but it is more likely to cause the computer to crash and blue screen because the underlying file system receives an FCB that it did not create itself.

For example, as shown in Figure 1, although the layered file system-based technology implements all file system interfaces, it is not registered as a real file system. Its essence is still a file filter driver, which is mounted on the same file system as the real file system. volume device. Therefore, if some antivirus software or malicious software also uses the file filtering driver method to filter the access requests of the shadow FCB, obtain the underlying file system device through the access request, and then directly send the access request to the underlying file system, the file system receives If you go to an FCB that is not maintained by yourself, reading and writing related data may cause the system to crash directly.

The transparent encryption method provided by the embodiment of the present invention first determines the type of the operation request, and then redirects it to the virtual disk file system or the real file system according to the type of the operation request, so as to realize the encryption of the decrypted target file and the encrypted target file Store and maintain separately. That is, the method realizes the transparent encryption of double-file control, and has the high performance and stability of a layered file system.

Furthermore, the transparent encryption method provided by the embodiment of the present invention can also solve the problem of compatibility with antivirus software. In the embodiment of the present invention, since the encrypted file system is registered as a real file system and mounted to the virtual disk, even if the antivirus software and the like filter the access request of the shadow FCB, the volume device obtained through the access request is still a virtual disk volume. The sent access request is finally processed by the encrypted file system, which can be encrypted and decrypted normally and transparently.

According to an embodiment of the present invention, an embodiment of a transparent encryption method is provided. It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and, although in The flowcharts show a logical order, but in some cases the steps shown or described may be performed in an order different from that shown or described herein.

In this embodiment, a transparent encryption method is provided, which can be used in electronic devices, such as terminals, servers, etc. FIG. 2 is a flowchart of a transparent encryption method according to an embodiment of the present invention. As shown in FIG. 2, the process includes the following step:

S11, acquiring an operation request of a target file.

Wherein, the operation request carries attribute information of the target file.

Operation requests include but are not limited to operations such as modifying, deleting, and copying target files, which are specifically set according to actual needs, and are not limited here. The operation request is a request sent when a specific processing operation is performed on the target file after the opening request. Wherein, the attribute information includes file information and process information of the target file, the file information includes operation information on the target file, that is, which operations are specifically performed, and the process information indicates which process currently accesses it.

S12. Determine the type of the operation request based on the attribute information.

Wherein, the type of the operation request includes an authorized operation request or an unauthorized operation request.

Files with authorized operations and their corresponding processes, and identifications of files with unauthorized operations and their processes are configured in the electronic device. After the attribute information is obtained, match the file information in the attribute information to determine the authorization process corresponding to the file; then use the process information to match the authorization process to determine the type of the operation request. For example, a process corresponding to a document or a form is determined as an authorized process, and a process corresponding to outgoing messages is determined as an unauthorized process.

S13. According to the type of the operation request, redirect the operation request to the virtual disk file system or the real file system.

The virtual disk file system is used to interact with the real file system, the virtual disk file is used to cache the decrypted target file, and the real file system is used to store the encrypted target file.

By configuring the virtual disk file system, the isolation from the real file system is realized. Moreover, the encrypted target file is stored in the real file system, and the decryption operation of the encrypted target file is realized through the virtual disk file system. Therefore, the virtual disk file system is used for caching the decrypted target file.

After the type of the operation request is determined, the operation request is redirected to the file system corresponding to the authorized operation request or the unauthorized operation request. Wherein, the authorized operation request corresponds to the virtual disk file system, and the unauthorized operation request corresponds to the real file system. For an authorized operation request, it can access the decrypted target file and process the decrypted target file accordingly; for an unauthorized operation request, it can only access the encrypted target file, and all The operation is to process the encrypted target file.

The transparent encryption method provided by this embodiment realizes the isolation of two forms of the same target file through the virtual disk file system, that is, the encrypted target file is stored in the real file system, and the decrypted target file is cached in the virtual disk file. In the system, the specific redirection is based on the type of operation request, thus realizing the transparent encryption of double file control, and having the high performance and stability of a layered file system.

In this embodiment, a transparent encryption method is provided, which can be used in electronic devices, such as terminals, servers, etc. FIG. 3 is a flowchart of a transparent encryption method according to an embodiment of the present invention. As shown in FIG. 3, the process includes the following step:

S21. Obtain an operation request of the target file.

Wherein, the operation request carries attribute information of the target file.

For details, refer to S11 in the embodiment shown in FIG. 2 , and details are not repeated here.

S22. Determine the type of the operation request based on the attribute information.

Wherein, the type of the operation request includes an authorized operation request or an unauthorized operation request.

For details, refer to S12 in the embodiment shown in FIG. 2 , and details are not repeated here.

S23. According to the type of the operation request, redirect the operation request to the virtual disk file system or the real file system.

The virtual disk file system is used to interact with the real file system, the virtual disk file is used to cache the decrypted target file, and the real file system is used to store the encrypted target file.

In some implementations, the virtual disk file system includes a virtual disk and an encrypted file system, the virtual disk is used to mount the encrypted file system, and the encrypted file system is used to read encrypted target files from the real file system for decryption. Virtual disks are implemented using RAM disks, providing a sandbox-like environment for mounting encrypted file systems and hiding them from users. The encrypted file system is mounted to the virtual disk, which implements all file system interfaces to the upper layer, not only handles upper layer read and write operations, but also interacts with the windows memory manager and cache manager to maintain shadow files and encrypted plaintext caches. When the lower layer reads and writes disk data, it interacts with the real file system where the encrypted target file is located, and handles the encryption and decryption of data and the hiding of encryption marks.

In order to realize the redirection processing of the operation request, the redirection is implemented through the encapsulated redirection module. For example, a file filter driver written using the microfilter framework is mounted on each disk volume of the electronic device. The file operation is transmitted in the kernel driver device stack through the operation request constructed by the IO manager. The mounted file filter driver can intercept all operation requests on the current disk volume, and the operation requests include the information of this file operation. According to the file information and process information in the intercepted operation request, the redirection module can determine whether to redirect the file access request to the virtual disk file system, so that the authorized process and the unauthorized process can access two files.

The shadow files maintained by the encrypted file system and the files maintained by the real file system actually correspond to the same physical disk file. The shadow file is used to cache the decrypted data, that is, the shadow file accesses the plaintext, and the real file system accesses the ciphertext, with high performance. and high stability. The redirection mechanism is used to forward the operation request to the virtual disk, which is compatible with anti-virus software and prevents the blue screen caused by the operation request of the transparent transmission shadow file to the real file system.

Based on this, the above S23 includes:

S231. When the type of the operation request is an authorized operation request, redirect the operation request to the virtual disk file system.

S232. Perform plaintext processing on the operation request based on the virtual disk file system.

When the type of the operation request is an authorized operation request, use the above-mentioned redirection module to redirect the operation request to the virtual disk file system. Since the shadow files in the virtual disk file system access plain text, therefore, in the virtual disk file system The operation request is processed in plain text.

In some implementations, the above S232 includes:

(1) Read the shadow file in the virtual disk to obtain the access path of the encrypted target file in the real file system.

(2) Read the encrypted target file from the real file system based on the access path.

(3) Use the encrypted file system to decrypt the encrypted target file, and use the shadow file to cache the decryption result to perform plaintext operations on the target file.

The shadow file is used to store the access path of the encrypted target file in the real file system. When there is an operation requirement for the target file, the encrypted target is read from the real file system using the access path recorded in the shadow file document. Then, the encrypted file system is used to decrypt the encrypted target file to obtain the decrypted target file. The decrypted target file is cached by using the shadow file. Based on this, for the specific processing of the operation request, the plaintext data cached in the shadow file can be processed.

The access path of the encrypted target file in the real file system is stored in the shadow file. Only when an operation request is received, the access path is used to read and decrypt the encrypted target file. By limiting the timing of reading, it can Reduce unnecessary memory overhead.

In some embodiments, step (1) of the above S232 includes:

1.1) When the authorization opening request of the target file is obtained, a shadow file is created in the virtual disk.

1.2) Record the access path of the encrypted target file in the real file system in the shadow file.

For the shadow file, the shadow file is created in the virtual disk when the authorization opening request of the target file is obtained, the shadow file is initialized, and the access path of the encrypted target file in the real file system is recorded. At this time, for the shadow file, only the access path is recorded, and the specific content of the encrypted target file is not involved. As mentioned above, only after receiving the authorization operation request, the encrypted target file will be pulled from the real file system by using the access path, decrypted by the encrypted file system and cached in the shadow file.

In some other implementation manners, the method further includes: clearing the shadow file in the virtual disk when the authorization closing request of the target file is obtained. Automatically clear shadow files in the virtual disk after use is complete. Shadow files are created and cleared according to requirements, which can release memory space in time and reduce memory consumption.

The transparent encryption method provided in this embodiment redirects the operation request to the virtual disk file system only when it is determined that the type of the operation request is an authorized operation request, so as to ensure the reliability of plaintext data.

In other embodiments, the method may also include:

(1) When the operation request is an unauthorized operation request, redirect the operation request to the real file system.

(2) Perform ciphertext operations on the target file based on the real file system.

For unauthorized operation requests, the operation requests are directly redirected to the real file system for ciphertext operations, which improves the security of the target files.

As shown in Fig. 4, when an application program is operated, an operation request (IRP) is generated, and the redirection module determines the type of the IRP. For an authorized process, redirect the IRP to the virtual disk file system; for an unauthorized process, directly redirect the IRP to the real file system. Among them, the virtual disk file system includes an encrypted file system and a virtual disk, and a shadow FCB is maintained in the encrypted file system, which can also be called a shadow file, and an access path is stored in the shadow file. The real FCB file data is read in the system, and the real file FCB data read at this time is encrypted data, which is decrypted by the encrypted file system and cached in the shadow file.

As a specific application example, as shown in Figure 5, taking the first time to open an encrypted file as an example, the specific workflow is as follows:

(1) The user uses a document editing program to open the D:\1.doc file, and the document editing program calls the create file system application interface to trigger a system call. After parsing the parameters, the IO manager constructs an open request containing the opening operation information and sends it to D The file system device stack of the disk, on which there are redirection modules, anti-virus software, file systems, etc., will process access requests in sequence.

(2) The redirection module mounted on the device stack filters the open request, obtains process information and file information according to the open request, and matches with the current encryption policy. For the authorization process, redirect it to the virtual disk.

(3) The encrypted file system mounted on the virtual disk receives an open request for an open operation. Based on the file information in the open request, the encrypted file system sends a request to open 1.doc to the file system device stack of the D drive and waits for the processing result . Wherein, the processing result includes opening failure or opening success. After receiving the processing result, the virtual disk creates a shadow file, initializes the member data in the shadow file, records the real file path in the shadow file, and returns the processing result to the IO manager and the upper application.

(4) The document editing program receives the processing result and the file handle, and the file pointed to by the file handle has been redirected to the shadow file in the virtual disk, and the operation request for subsequent file operations is directly sent to the encrypted file system for processing.

(5) If an unauthorized process accesses D:\1.doc, the redirection module directly sends the operation request to the real file system of the D:\ disk, and what is accessed is a real file maintained by the real file system, that is, an encrypted file.

By establishing a shadow file, the access isolation between authorized process and unauthorized process is realized. For the subsequent read and write operations of the document editing program, after receiving the operation request, the encrypted file system reads the file ciphertext data from the real file system, and The data is decrypted and returned to the document editing program; during the write operation, the plaintext data of the document editing program is encrypted and sent to the real file system to realize transparent encryption and decryption.

In this embodiment, a transparent encryption device is also provided, which is used to implement the above embodiments and preferred implementation modes, and what has already been described will not be repeated. As used below, the term "module" may be a combination of software and/or hardware that realizes a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementations in hardware, or a combination of software and hardware are also possible and contemplated.

This embodiment provides a transparent encryption device, as shown in Figure 6, including:

An acquisition module 41, configured to acquire an operation request of a target file, wherein the operation request carries attribute information of the target file;

A determining module 42, configured to determine the type of the operation request based on the attribute information, where the type of the operation request includes an authorized operation request or an unauthorized operation request;

The redirection module 43 is configured to redirect the operation request to a virtual disk file system or a real file system according to the type of the operation request, the virtual disk file system is used to interact with the real file system, and the virtual The disk file is used to cache the decrypted target file, and the real file system is used to store the encrypted target file.

In some implementations, redirection module 43 includes:

A first redirecting unit, configured to redirect the operation request to the virtual disk file system when the type of the operation request is an authorized operation request;

The first processing unit is configured to process the operation request in plaintext based on the virtual disk file system.

In some implementations, the virtual disk file system includes a virtual disk and an encrypted file system, the virtual disk is used to mount the encrypted file system, and the encrypted file system is used to read encrypted files from the real file system After the target file is decrypted.

In some embodiments, the first processing unit includes:

A first reading subunit, configured to read the shadow file in the virtual disk to obtain the encrypted access path of the target file in the real file system;

a second reading subunit, configured to read the encrypted target file from the real file system based on the access path;

The plaintext operation subunit is used to decrypt the encrypted target file by using the encrypted file system, and cache the decryption result by using the shadow file, so as to perform plaintext operations on the target file.

In some embodiments, the first reading subunit comprises:

Create a subunit, used to create a shadow file in the virtual disk when the authorization opening request for the target file is obtained;

The recording subunit is configured to record the encrypted access path of the target file in the real file system in the shadow file.

In some embodiments, the device also includes:

A clearing module, configured to clear the shadow file in the virtual disk when the authorization closing request of the target file is obtained.

In some embodiments, the device also includes:

a first redirecting unit, configured to redirect the operation request to the real file system when the operation request is an unauthorized operation request;

A ciphertext operation unit, configured to perform ciphertext operations on the target file based on the real file system.

The transparent encryption device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC circuit, a processor and memory that execute one or more software or fixed programs, and/or other devices that can provide the above functions .

Further functional descriptions of the above-mentioned modules are the same as those in the above-mentioned corresponding embodiments, and will not be repeated here.

An embodiment of the present invention also provides an electronic device having the transparent encryption device shown in FIG. 6 above.

Please refer to FIG. 7. FIG. 7 is a schematic structural diagram of an electronic device provided in an optional embodiment of the present invention. As shown in FIG. 7, the electronic device may include: at least one processor 51, such as a CPU (Central Processing Unit, central processor), at least one communication interface 53, memory 54, and at least one communication bus 52. Wherein, the communication bus 52 is used to realize connection and communication between these components. Wherein, the communication interface 53 may include a display screen (Display) and a keyboard (Keyboard), and the optional communication interface 53 may also include a standard wired interface and a wireless interface. The memory 54 may be a high-speed RAM memory (Random Access Memory, volatile random access memory), or a non-volatile memory (non-volatile memory), such as at least one magnetic disk memory. Optionally, the memory 54 may also be at least one storage device located away from the aforementioned processor 51 . Wherein the processor 51 can be combined with the device described in FIG. 6 , the memory 54 stores an application program, and the processor 51 invokes the program code stored in the memory 54 to execute any of the above method steps.

Wherein, the communication bus 52 may be a peripheral component interconnect (PCI for short) bus or an extended industry standard architecture (EISA for short) bus or the like. The communication bus 52 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in FIG. 7 , but it does not mean that there is only one bus or one type of bus.

Wherein, the memory 54 may include a volatile memory (English: volatile memory), such as a random-access memory (English: random-access memory, abbreviated as RAM); the memory may also include a non-volatile memory (English: non-volatile memory), such as flash memory (English: flash memory), hard disk (English: hard diskdrive, abbreviated: HDD) or solid-state hard disk (English: solid-state drive, abbreviated: SSD); memory 54 can also include the above-mentioned types of memory The combination.

Wherein, the processor 51 may be a central processing unit (English: central processing unit, abbreviated: CPU), a network processor (English: network processor, abbreviated: NP) or a combination of CPU and NP.

Wherein, the processor 51 may further include a hardware chip. The aforementioned hardware chip may be an application-specific integrated circuit (English: application-specific integrated circuit, abbreviation: ASIC), a programmable logic device (English: programmable logic device, abbreviation: PLD) or a combination thereof. The above-mentioned PLD can be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), field-programmable logic gate array (English: field-programmable gate array, abbreviation: FPGA), general array logic (English: generic array logic , Abbreviation: GAL) or any combination thereof.

Optionally, memory 54 is also used to store program instructions. The processor 51 may invoke program instructions to implement the transparent encryption method as shown in any embodiment of the present application.

The embodiment of the present invention also provides a non-transitory computer storage medium, the computer storage medium stores computer-executable instructions, and the computer-executable instructions can execute the transparent encryption method in any of the above method embodiments. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a flash memory (Flash Memory), a hard disk (Hard Disk) DiskDrive, abbreviation: HDD) or solid-state disk (Solid-State Drive, SSD), etc.; the storage medium may also include a combination of the above-mentioned types of memory.

Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present invention. within the bounds of the requirements.

Claims (10)

1. A transparent encryption method, comprising:

acquiring an operation request of a target file, wherein the operation request carries attribute information of the target file;

determining the type of the operation request based on the attribute information, wherein the type of the operation request comprises an authorized operation request or an unauthorized operation request;

redirecting the operation request to a virtual disk file system or a real file system according to the type of the operation request, wherein the virtual disk file system is used for interacting with the real file system, the virtual disk file is used for caching the decrypted target file, and the real file system is used for storing the encrypted target file.

2. The method of claim 1, wherein redirecting the operation request to a virtual disk file system or a real file system according to the type of the operation request comprises:

when the type of the operation request is an authorized operation request, redirecting the operation request to the virtual disk file system;

and performing plaintext processing on the operation request based on the virtual disk file system.

3. The method according to claim 2, wherein the virtual disk file system comprises a virtual disk and an encrypted file system, the virtual disk is used for mounting the encrypted file system, and the encrypted file system is used for reading the encrypted target file from the real file system for decryption.

4. The method of claim 3, wherein the performing a plaintext operation on the target file based on the virtual disk file system comprises:

reading the shadow file in the virtual disk to obtain an access path of the encrypted target file in the real file system;

reading the encrypted target file from the real file system based on the access path;

and decrypting the encrypted target file by using an encrypted file system, and caching a decryption result by using the shadow file so as to perform plaintext operation on the target file.

5. The method according to claim 4, wherein the reading the shadow file in the virtual disk to obtain the encrypted access path of the target file in the real file system comprises:

when an authorized opening request of the target file is acquired, a file is created in the virtual disk;

and recording an access path of the encrypted target file in the real file system in the shadow file.

6. The method of claim 4, further comprising:

and when the request for closing the authorization of the target file is acquired, the shadow file is cleared in the virtual disk.

7. The method of claim 2, further comprising:

when the operation request is an unauthorized operation request, redirecting the operation request to the real file system;

and carrying out ciphertext operation on the target file based on the real file system.

8. A transparent encryption apparatus, comprising:

the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring an operation request of a target file, and the operation request carries attribute information of the target file;

a determining module, configured to determine a type of the operation request based on the attribute information, where the type of the operation request includes an authorized operation request or an unauthorized operation request;

and the redirection module is used for redirecting the operation request to a virtual disk file system or a real file system according to the type of the operation request, wherein the virtual disk file system is used for interacting with the real file system, the virtual disk file is used for caching the decrypted target file, and the real file system is used for storing the encrypted target file.

9. An electronic device, comprising:

a memory and a processor, the memory and the processor being communicatively connected to each other, the memory having stored therein computer instructions, the processor executing the computer instructions to perform the transparent encryption method of any one of claims 1-7.

10. A computer-readable storage medium storing computer instructions for causing a computer to perform the transparent encryption method of any one of claims 1-7.

Images